From d43381727df0786cc28356da0af97cd70eccbade Mon Sep 17 00:00:00 2001 From: Daniel Fainberg Date: Tue, 7 Jul 2026 08:54:48 +0200 Subject: [PATCH] fix(desktop): don't prompt on ssh presence/confirm askpass calls MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Forced askpass routes the "Confirm user presence" touch notifications (SSH_ASKPASS_PROMPT=none) through the helper too, which blindly asked for a PIN — three dialogs per push. Only prompt for the real passphrase; let the informational calls succeed silently (the FIDO touch is hardware-enforced). Co-Authored-By: Claude Opus 4.8 --- modules/home.nix | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/modules/home.nix b/modules/home.nix index 171c7d0..9433121 100644 --- a/modules/home.nix +++ b/modules/home.nix @@ -13,7 +13,13 @@ let # SSH_ASKPASS helper that drives the GPG pinentry-qt: ssh passphrase/PIN # prompts reuse the same Qt dialog as commit signing, adding no extra GUI # toolkit (a packaged askpass would drag in KDE/GTK — hundreds of MB). + # ssh signals the prompt kind via $SSH_ASKPASS_PROMPT (OpenSSH ≥ 8.4): + # empty real passphrase/PIN entry — collect input, echo to stdout + # confirm/none informational, e.g. "Confirm user presence" (touch request) + # A FIDO touch can't be faked by software, so those messages need no dialog: + # succeed silently instead of popping a spurious PIN box (the token blinks). sshAskpass = pkgs.writeShellScript "ssh-askpass-pinentry" '' + [ -n "''${SSH_ASKPASS_PROMPT:-}" ] && exit 0 desc=$(printf '%s' "''${1:-Passphrase:}" | sed 's/%/%25/g') printf 'SETTITLE ssh\nSETPROMPT PIN:\nSETDESC %s\nGETPIN\nBYE\n' "$desc" \ | ${pkgs.pinentry-qt}/bin/pinentry-qt \